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This listing of claims replaces all prior versions, and 
listings of claims in the instant application: 



Listing of Claims: 

1. (Currently Amended) A method for executing an 
obfuscated application program, the method comprising: 

receiving an obfuscated application program, said 
obfuscated application program comprising at least one 
instruction opcode value encoded using one of a 
plurality of instruction set opcode value encoding 
schemes; 

receiving an application program instruction 
corresponding to a current instruction counter valued- 
selecting an instruction dispatch table based at 
least in part on said current instruction counter 
value; and 

executing said application program instruction 
using said selected instruction dispatch table to 
obtain a reference to an instruction implementation 
method corresponding to the opcode value of the said 
application program instruction . 

2. (Currently Amended) The method of claim 1, further 
comprising : 

determining whether there is another application 
program instruction to be executed; 

advancing said current instruction counter if 
there is another application program instruction to be 
executed; and 

repeating said receiving said application program 
instruction ^ said selecting and said executing after 
said advancing. 
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number of dispatch tables, each of said dispatch tables 
associated with a unique number between 0 and n-1; and 

selecting the instruction dispatch table 
associated with the result of said modulo-n arithmetic 
operation. 

4. (Currently Amended) The method of claim 1 wherein 
the number of instruction dispatch tables is based at least 
in part on a^fefee number of instructions in a th e larg e ot 
method of said obfuscated application program. 

5. (Original) The method of claim 4 wherein said 
number of instruction dispatch tables is greater than or 
equal to said number of instructions. 

6. (Original) The method of claim 5 wherein said 
number of instruction dispatch tables equals said number of 
instructions . 

7. (Currently Amended) The method of claim 1 wherein 
the number of instruction dispatch tables is based at least 
in part on an amount of available memory. 

8. (Currently Amended) A method for application 
program obfuscation, the method comprising: 

reading an application program comprising code; 
determining a plurality of dispatch tables 
associated with said application programs- 
transforming said application program into 
application program code configured to utilize said 
plurality of dispatch tables during application program 
execution to determine the location of instruction 
implementation methods to be executed based at least 4ft 
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part on using a current instruction counter value to 
select a dispatch table in said plurality of dispatch 
tables for use with an application program instruction 
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corresponding to said current instruction counter 
value ; and 

sending said application program code. 

9. (Currently Amended) The method of claim 8 wherein 
said determining further comprises determining the encoding 
of said plurality of dispatch tables based at least in part 
on a relative frequency of instructions in said application 
program code . 

10. (Original) The method of claim 8 wherein said 
determining further comprises filtering said plurality of 
dispatch tables to flatten the frequency distribution of 
instructions over said transformed application program code. 

11. (Original) The method of claim 8 wherein 



transforming, applying a cryptographic process to said 
application program code together with a cryptographic 
key to create an encrypted obfuscated application 
program; and 

said sending comprises sending said encrypted 
obfuscated application program. 

12. (Currently Amended) A program storage device 
readable by a machine, embodying a program of instructions 
executable by the machine to perform a method for executing 
an obfuscated application program, the method comprising: 

receiving an obfuscated application program, said 
obfuscated application program comprising at least one 
instruction opcode value encoded using one of a 
plurality of instruction set opcode value encoding 
schemes; 



said method further comprises, after said 



GUNNISON. McKAY & 

HODGSON, UL.P. 
Garden Wcsl Ofllcc Plaza 
1900 Garden Road. Suite 220 
Monicrcy, CA 93940 

(83])6SS-088O 
Fax (83 1)633-0888 



receiving an application program instruction 
corresponding to a current instruction counter value; 
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selecting an instruction dispatch table based at 
least in part on said current instruction counter 
value; and 

executing said application program instruction 
using said selected instruction dispatch table to 
obtain a reference to an instruction implementation 
method corresponding to the opcode value of the said 
application program instruction . 

13. (Currently Amended) The program storage device of 
claim 12, said method further comprising: 

determining whether there is another application 
program instruction to be executed; 

advancing said current instruction counter if 
there is another application program instruction to be 
executed; and 

repeating said receiving said application program 
instruction ^ said selecting and said executing after 
said advancing. 

14 . (Currently Amended) The program storage device of 
claim 12 wherein said selecting further comprises: 

performing modulo-n arithmetic operation on said 
current instruction counter value, where n is the 
number of dispatch tables, each of said dispatch tables 
associated with a unique number between 0 and n-1; and 

selecting the instruction dispatch table 
associated with the result of said modulo-n arithmetic 
operation. 

15. (Currently Amended) The program storage device of 
claim 12 wherein the number of instruction dispatch tables 
is based at least in part on a th e number of instructions in 

a th e largest method of said obfuscated application program. 
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16. (Original) The program storage device of claim 15 
wherein said number of instruction dispatch tables is 
greater than or equal to said number of instructions. 

17. (Original) The program storage device of claim 16 
wherein said number of instruction dispatch tables equals 
said number of instructions. 

18. (Currently Amended) The program storage device of 
claim 12 wherein the number of instruction dispatch tables 
is based at least in part on an amount of available memory. 

19. (Currently Amended) A program storage device 
readable by a machine, embodying a program of instructions 
executable by the machine to perform a method for 
application program obfuscation, the method comprising: 

reading an application program comprising code; 
determining a plurality of dispatch tables 
associated with said application programs- 
transforming said application program into 
application program code configured to utilize said 
plurality of dispatch tables during application program 
execution to determine the location of instruction 
implementation methods to be executed based at least 4=^ 
part on using a current instruction counter value to 
select a dispatch table in said plurality of dispatch 
tables for use with an application program instruction 
corresponding to said current instruction counter 
value ; and 

sending said application program code. 

20. (Currently Amended) The program storage device of 
claim 19 wherein said determining further comprises 
determining the encoding of said plurality of dispatch 
tables based at least in part on a relative frequency of 
instructions in said application program code. 
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21. (Original) The program storage device of claim 19 
wherein said determining further comprises filtering said 
plurality of dispatch tables to flatten the frequency 
distribution of instructions over said transformed 
application program code. 

22. (Original) The program storage device of claim 19 
wherein 

said method further comprises, after said 
transforming, applying a cryptographic process to said 
application program code together with a cryptographic 
key to create an encrypted obfuscated application 
program; and 

said sending comprises sending said encrypted 
obfuscated application program. 

23 . (Currently Amended) An apparatus for executing an 
obfuscated application program, the apparatus comprising: 

means for receiving an obfuscated application 
program, said obfuscated application program comprising 
at least one instruction opcode value encoded using one 
of a plurality of instruction set opcode value encoding 
schemes ; 

means for receiving an application program 
instruction corresponding to a current instruction 
counter valued- 
means for selecting an instruction dispatch table 
based at least in part on said current instruction 
counter value; and 

means for executing said application program 
instruction using said selected instruction dispatch 
table to obtain a reference to an instruction 
implementation method corresponding to the opcode value 
of the said application program instruction . 



24 . (Currently Amended) 
further comprising : 



The apparatus of claim 23, 
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means for determining whether there is another 
application program instruction to be executed; 

means for advancing said current instruction 
counter if there is another application program 
instruction to be executed; and 

means for repeating said receiving said 
application program instruction , said selecting and 
said executing after said advancing. 

25. (Currently Amended) The apparatus of claim 23 
wherein said means for selecting further comprises: 

means for performing modulo-n arithmetic operation 
on said current instruction counter value, where n is 
the number of dispatch tables, each of said dispatch 
tables associated with a unique number between 0 and n- 
1 ; and 

means for selecting the instruction dispatch table 
associated with the result of said hiodulo-n arithmetic 
operation . 

26. (Currently Amended) The apparatus of claim 23 
wherein the number of instruction dispatch tables is based 
at least in part on a th e number of instructions in a the 
largest method of said obfuscated application program. 

27. (Original) The apparatus of claim 26 wherein said 
number of instruction dispatch tables is greater than or 
equal to said number of instructions. 

28. (Original) The apparatus of claim 27 wherein said 
number of instruction dispatch tables equals said number of 
instructions . 
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29. 



(Currently Amended) The apparatus of claim 23 



wherein the number of instruction dispatch tables is based 
at least in part on an amount of available memory. 
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30. (Currently Amended) An apparatus for application 
program obfuscation, the apparatus comprising: 

a processor; and 

a memory, coupled to said processor, having stored 
therein computer readable instructions wherein 
executing said computer readable instructions on said 
processor provides : 



means for reading an application program 
comprising code; 

means for determining a plurality of dispatch 
tables associated with said application program; 

means for transforming said application 
program into application program code configured 
to utilize said plurality of dispatch tables 
during application program execution to determine 
the location of instruction implementation methods 
to be executed based at least in part on using a 
current instruction counter value to select a 
dispatch table in said plurality of dispatch 
tables for use with an application program 
instruction corresponding to said current 
instruction counter value ; and 

means for sending said application program 

code . 



31. (Currently Amended) The apparatus of claim 30 
wherein said means for determining further comprises means 
for determining the encoding of said plurality of dispatch 
tables based at least in part on a relative frequency of 
instructions in said application program code. 

32. (Original) The apparatus of claim 30 wherein said 
means for determining further comprises filtering said 
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plurality of dispatch tables to flatten the frequency 
distribution of instructions over said transformed 
application program code. 
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33. (Original) The apparatus of claim 30 wherein 

said apparatus further comprises, means for 
applying a cryptographic process to said application 
program code together with a cryptographic key to 
create an encrypted obfuscated application program in 
response to said transforming; and 

said means for sending comprises means for sending 
said encrypted obfuscated application program. 

34- (Currently Amended) An apparatus for executing an 
obfuscated application program, the apparatus comprising a 
user device configured to: 

receive an obfuscated application program, said 
obfuscated application program comprising at least one 
instruction opcode value encoded using one of a 
plurality of instruction set opcode value encoding 
schemes; 

receive an application program instruction 
corresponding to a current instruction counter value; 

select an instruction dispatch table based at 
least in part on said current instruction counter 
value ; and 

execute said application program instruction using 
said selected instruction dispatch table to obtain a 
reference to an instruct ion implementation method 
corresponding to the opcode value of the said 
application program instruction . 

35. (Currently Amended) The apparatus of claim 34, 
said user device further configured to: 



determine whether there is another application 
program instruction to be executed; 
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advance said current instruction counter if there 
is another application program instruction to be 
executed; and 
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repeat said receiving said application program 
instruction , said selecting and said executing after 
said advancing. 

36. (Currently Amended) The apparatus of claim 34 
wherein said user device is further configured to: 

perform modulo-n arithmetic operation on said 
current instruction counter value, where n is the 
number of dispatch tables, each of said dispatch tables 
associated with a unique number between 0 and n-1; and 

select the instruction dispatch table associated 
with the result of said modulo-n arithmetic operation. 

37. (Currently Amended) The apparatus of claim 34 
wherein the number of instruction dispatch tables is based 
at least in part on atbe number of instructions in atfee 
largest method of said obfuscated application program. 

38. (Original) The apparatus of claim 37 wherein said 
number of instruction dispatch tables is greater than or 
equal to said number of instructions. 

39. (Original) The apparatus of claim 38 wherein said 
number of instruction dispatch tables equals said number of 
instructions . 

40. (Currently Amended) The apparatus of claim 34 
wherein the number of instruction dispatch tables is based 
at least in part on an amount of available memory. 

41. (Currently Amended) An apparatus for application 
program obfuscation, the apparatus comprising an application 
program provider including a processor, and memory, coupled 
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to said processor, having stored therein computer readable 
instructions wherein upon executing said computer readable 
instructions on said processor said application program 
provider is configured to: 
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read an application program comprising code; 

determine a plurality of dispatch tables 
associated with said application program; 

transform said application program into 
application program code configured to utilize said 
plurality of dispatch tables during application program 
execution to determine the location of instruction 
implementation methods to be executed based at least -ift 
part on use of a current instruction counter value to 
select a dispatch table in said plurality of dispatch 
tables for use with an application program instruction 
corresponding to said current instruction counter 
value ; and 

send said application program code. 

42. (Currently Amended) The apparatus of claim 41 
wherein said application program provider is further 
configured to determine the encoding of said plurality of 
dispatch tables based at least in part on a relative 
frequency of instructions in said application program code. 

43. (Original) The apparatus of claim 41 wherein said 
application program provider is further configured to filter 
said plurality of dispatch tables to flatten the frequency 
distribution of instructions over said transformed 
application program code. 

44. (Original) The apparatus of claim 41 wherein 
said application program provider is further 

configured to apply a cryptographic process to said 
application program code together with a cryptographic 
key to create an encrypted obfuscated application 
program; and 
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said application program provider is further 
configured to send said encrypted obfuscated 
application program. 
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45. (Currently Amended) A data processing system 
comprising : 

a processor; and 

memory , coupled to said processor, for storing data for 
access by an application program being executed on said a: 
data processing system, said memory comprising: 

a data structure stored in said memory, said data 
structure including information used by said 
application program to execute an obfuscated 
application program on said data processing system ^ 
said data structure comprising application program code 
configured to utilize a plurality of dispatch tables 
during execution of said obfuscated application program 
to determine a^4ie location of instruction 
implementation methods to be executed based at least ifi 
part on using a current instruction counter value to 
select a dispatch table in said plurality of dispatch 
tables for use with an application program instruction 
corresponding to said current instruction counter 
value . 
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46. (Original) The memory of claim 45 wherein said 
data structure further comprises a cryptographic key and 
protected data, said protected data encrypted using said 
cryptographic key. 

47. (Original) The memory of claim 4 5 wherein said 
data structure further comprises an obfuscation descriptor 
that indicates an obfuscation method used to create said 
obfuscated application program. 

48. (Currently Amended) A data processing system 
comprising : 

a processor; and 

memor y^ coupled to said processor, for storing data for 
access by an application program being executed on saida : 
data processing system, said memory comprising: 
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a data structure stored in said memory, said data 
structure including information used by said 
application program to execute an obfuscated 
application program, said data structure comprising a 
plurality of dispatch tables used during execution of 
said obfuscated application program to determine a th e 
location of instruction implementation methods to be 
executed based at least in part on using a current 
instruction counter value to select a dispatch table in 
said plurality of dispatch tables for use with an 
application program instruction corresponding to said 
current instruction counter value. 
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